Notepad++ Hijacked by State-Sponsored Hackers
Notepad++
According to the analysis provided by the security experts, the attack involved infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. The exact technical mechanism remains under investigation, though the compromise occured at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.
The incident began from June 2025. Multiple independaent security researchers have assessed that the threat acotor is likely a Chinese state-sponsored group, which would explain the highly selective targeting obseved during the campaign.
Zerosquare (./2346) :C'est clair, mais comme tu dis, une (très) bonne hygiène informatique peut bien compliquer le boulot.
Dans l'absolu oui, mais là c'est un cas exceptionnel : si tu en es au point d'être ciblé par un État, la plupart des conseils de sécurité usuels ne suffiront pas
the method used to lock or pin an app varies between manufacturers, making it hard for malware to script the right way to do so on every device. That is where AI comes into play.On n'arrête pas le progrès !
PromptSpy sends Google's Gemini model a chat prompt along with an XML dump of the current screen, including the visible UI elements, text labels, class types, and screen coordinates.
Gemini then responds with JSON-formatted instructions describing the action to take on the device to pin the app.
The malware executes the action through Android's Accessibility Service, retrieves the updated screen state, and sends it back to Gemini in a loop until the AI confirms that the app has been successfully locked in the recent apps list.
)Zerosquare (./2355) :
Si on est cynique, on peut se dire que tôt ou tard, le projet sera complètement ingérable, et qu'ils devront appeler un vrai développeur à la rescousse (qui pourra facturer fort cher pour tout refaire from scratch - quoi, on peut rêver, non ?).
SCPCD (./2358) :J'en sais pas plus, et je dirais même que tu me fais un peu peur !
Il ne me semble pas avoir vu de com ici sur l'expiration des certificats Secure Boot Windows qui a lieu cette année.
Vous en savez plus ?
SCPCD (./2358) :Je crois qu'on en avait parlé dans le topic Windows, mais c'était il y a pas mal de temps. Voici un article récent :
Il ne me semble pas avoir vu de com ici sur l'expiration des certificats Secure Boot Windows qui a lieu cette année.
Vous en savez plus ?
C'est quoi l'impact notamment sur les vieilles machines ?
Y a des trucs à faire ?
etc..
Critical compromise: Axios NPM library with 100M weekly downloads is delivering malware
Cybernews
Axios, a hugely popular JavaScript library with 100 million weekly downloads, has been hit by a critical supply chain attack. In a recurring open-source security crisis, developers unknowingly pulled a remote-access trojan from compromised releases.
The lead maintainer of axios, one of the most popular NPM packages, had his account hijacked, allowing attackers to publish new axios releases containing malware. Cybersecurity researchers are alerting developers not to upgrade and check for potential compromise.
Axios is a JavaScript library to make HTTP requests from browsers and Node.js environments, used in millions of projects to simplify communication with APIs. Developers favor it for built-in data transformation, request cancellation, timeout controls, and error handling.
The poisoned axios releases include versions 1.14.1 and 0.30.4. They include a new dependency “plain-crypto-js@4.2.1,” which executes a post-install script dropping a remote access trojan (RAT) targeting major OSes: Linux, macOS, and Windows. The RAT pulls second-stage malware from an attacker-controlled server.
